Help with loopback policy

[Brian Anderson]

I have a win2k terminal server I have a few specific settings on,
namely, removing shut down from the start menu, adding log off, and
making the C:\ drive inaccessible on the machine. I have two remote
stores that are dependent on terminal services, as well as a few local
users who use terminal services for various reasons. So what I think I
need is a loopback policy on the terminal server to make sure any local
user who logs on has the shut down removed from the start on the
terminal server, but when on their local machine shut down is present.
I think this is the "replace" option. Question is, how do I set this
up so my user has the shut down option when logged on? I want to be
able to remotely control and shut down/reboot the machine if necessary.
If I'm using the GPMC, do I place my user name in the Delegation Tab >
Advanced button > Security setting with a deny to "apply Group Policy"?

Also, if the Terminal Server is in its own OU, all GPO's with user
configuration settings in that OU are applied via the loopback policy,
correct?

Thanks!
Brian

 

[Florian Frommherz]

Howdy Brian!

So what I think I
need is a loopback policy on the terminal server to make sure any local
user who logs on has the shut down removed from the start on the
terminal server, but when on their local machine shut down is present.
I think this is the "replace" option. Question is, how do I set this
up so my user has the shut down option when logged on? I want to be
able to remotely control and shut down/reboot the machine if necessary.
If I'm using the GPMC, do I place my user name in the Delegation Tab >
Advanced button > Security setting with a deny to "apply Group Policy"?

Yes, I'd do so. Or a little better: create an Active Directory Group
called "Terminal Servers Administrators" or something similar to that
and deny this group "Apply Group Policy" rights. Makes things easier if
you searched for the reason why the policy doesn't apply to some accounts...

Also, if the Terminal Server is in its own OU, all GPO's with user
configuration settings in that OU are applied via the loopback policy,
correct?

Yes - if Loopback is enabled.

cheers,

Florian

 

[Brian Anderson]

Thanks Florian!

Looks like there was a Terminal Services Admin group I didn't know
about, so I added myself to the group, set the loopback and it looks
like it works.

Thanks for the help!
Brian